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AMENDMENTS TO THE CLAIMS: 

This listing of claims will replace all prior versions and listings of the claims in 
the application: 

1 . (Currently Amended) A method for protecting electronic media content from 
unauthorized use by a user of a computer system, the method including: 

receiving a request from a user of the computer system to aooc s s use a piece 
of electronic media content; 

identifying one or more software modules responsible for processing the piece of 
electronic media content and enabling use of the piece of electronic media content by 
the user : 

evaluating one or more predefined characteristics of the one or more software 
modules to determine if the one or more software modules are operable to process 
the electronic media content in an authorized manner, the evaluating including at least 
one protection mechanism selected from the group consisting of: 

evaluating whether the one or more software modules make calls to 
certain system interfaces: 

determining whether the one or more software modules include one or 
more predefined code sequences associated with undesirable behavior: 

analyzing dynamic timing characteristics of the one or more software 
modules for anomalous timing characteristics indicative of invalid or malicious 
activity: 

determining whether the one or more software modules are included on 
ajist of trusted software modules: 

determining whether the one or more software modules are included on 
a list of untrusted software modules: and 

determining whether the one or more software modules have been 
digitally signed bv a trusted party : and 
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denying the request to assess use the piece of electronic media content if the 
evaluation of the one or more predefined characteristics fail to satisfy a set of 
predefined criteria. 

2. (Currently Amended) A method as in claim 1 , further including: 

using the predefined criteria to evaluate the predefined characteristics of the one 
or more so ftware modules according to a predefined policy, and basing a decision to 
deny the request on the outcome of this evaluation. 

3. (Currently Amended) A method as in claim 1 , in which the evaluating one or 
more predefined characteristics of the one or more software modules includes 
computing the cryptographic hash of at least one of the one or more software 
modules. 

4. (Currently Amended) A system for protecting electronic media content and 
enabling use of the electronic media content by a user , the system comprising: 

means for applying a cryptographic fingerprint to the electronic media content; 
means for evaluating one or more predefined characteristics of one or more e^ 
tbe drivers responsible for handling the electronic media conten t, the means for 
evaluating including means for operating a protection mechanism selected from the 
group consisting of: 

means for evaluating whether the one or more drivers make calls to 
certain system interfaces: 

means for determining whether the one or more drivers include one or 
more predefined code sequences associated with undesirable behavior: 

means for analyzing dynamic timing characteristics of the one or more 
drivers for anomalous timi ng characteristics indicative of invalid or malicious 
activity: 

means for determining whether the one or more drivers are included on 
a list of trusted drivers: 
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means for determining whether the one or more drivers are included on 
a list of untrusted drivers: and 

means for determining whether the one or more drivers have been 
digitally signed bv a trusted party : 

means for denying effective access to the electronic media content based on an 
output of said means for evaluating one or more predefined characteristics of the 
drivers responsible for handling the electronic media content; 

means for generating an identifier associated with the electronic media content; 

means for monitoring a predefined system interface for data containing the 
identifier; and 

means for preventing effective access to data containing the identifier via the 
predefined system interface. 

5. (Currently Amended) A method for protecting electronic media content from 

unauthorized use, the method including: 

receiving a request to access a piece of electronic media content; 
generating a first identifier associated with the electronic media content; and 
monitoring at least one system Interface for electronic data , the monitoring 



receiving a piece of electronic data; 

generating a second identifier associated with the piece of electronic 

data; 

comparing the second identifier with the first identifier; and 
taking a predefined defensive action if the second identifier is related to 
the first identifier in a predefined manne r, wherein the predefined defensive 
action is selected from the group consisting of: modifying at least a portion of the 
piece of electronic data, or preventing the transfer of at least a portion of the 
piece of electronic data to an output device via the system interface . 



including: 
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6. (Currently Amended) A method as in claim 5, wherein the piece of electronic 
media content is encrypted and further including: 

decrypting the electronic media content. 

7. (Currently Amended) A method as in claim 5, in which the first identifier 
comprises a hash of at least a portion of the electronic media content, and in which 
the second Identifier comprises a hash of at least a portion of the piece of electronic 
data. 

8. (Currently Amended) A method as in claim 5, in which the first identifier 
comprises a predefined portion of the electronic media content and in which the 
second identifier comprises a predefined portion of the piece of electronic data, 

9. (Original) A method as in claim 5, in which the system interface comprises a 
file system interface to one or more device drivers. 

10. (Original) A method as in claim 5, in which the predefined defensive action 
comprises modifying at least a portion of the piece of electronic data, 

1 1 . (Original) A method as in claim 1 0 f in which modifying at least a portion of the 
piece of electronic data includes scrambling at least a portion of the piece of electronic 
data. 

12. (Original) A method as in claim 5, in which the predefined defensive action 
comprises adding noise to at least a portion of the piece of electronic data. 

13. (Original) A method as in claim 5, in which the predefined defensive action 
comprises adding an electronic watermark or fingerprint to at least a portion of the 
piece of electronic data. 
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14. (Original) A method as in claim 5, in which the predefined defensive action 
comprises preventing the transfer of at least a portion of the piece of electronic data to 
an output device via the system interface. 



first identifier and the second identifier comprises the first identifier being equal to the 
second identifier. 

16. (Currently Amended) A method as in claim 5, in which the at least one system 
interface is selected using rules associated with the electronic media content, the rules 
being operable to identify certain system interfaces to which the electronic media 
content is not allowed to be sent. 

1 7. (Original) A method as in claim 9, in which the one or more device drivers are 
selected from the group consisting of: video display driver, sound driver, SCSI driver, 
IDE driver, network driver, video capture driver, floppy disk driver, and scanner driver, 

18. (Currently Amended) A method as in claim 5, further including: 

inserting a cryptographic fingerprint into the piece of electronic media content, 
the cryptographic fingerprint containing information relating to the request to access 
said piece of electronic media content. 

19. (Currently Amended) A method as in claim 4? 18, in which inserting said 
cryptographic fingerprint into the piece of electronic media content includes: 

authenticating a fingerprinting engine using a cryptographic credential; and 
using the fingerprinting engine to insert the cryptographic fingerprint into the 
piece of electronic media content. 

20. (Original) A method as in claim 19, in which the fingerprinting engine is 
operable to authenticate a calling application using a cryptographic credential. 



15. (Original) A method as in claim 5, in which the predefined relation between the 
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